$500 idea · Pattern break · Singapore · Edition 007
Singapore fined a travel company S$47,000 over an appointment that costs nothing to make.
In Air Sino-Euro Associates Travel Pte. Ltd., Case No. DP-2312-C1857, [2025] SGPDPC 5, decided 31 October 2025, the Personal Data Protection Commission found that the organisation had no data protection officer until 15 April 2024, after the incident, and held: “The appointment of a DPO is a basic requirement, and part of the Accountability Obligation.” Section 11(3) of the Personal Data Protection Act 2012 requires every organisation to “designate one or more individuals” to be responsible for compliance. There are 625,437 live entities on ACRA’s register. The role carries no licence, no examination and no fee — and the maximum penalty behind it is S$1 million or 10% of annual turnover in Singapore, whichever is higher.
Singapore has a privacy law that binds every registered business in the country, from the largest bank to a one-person shop. It requires each of them to name a person who is answerable for how the business handles other people’s personal information, and to publish that person’s contact details so the public can reach them. Nobody checks whether the named person knows anything — there is no exam, no licence and no fee attached to the role — but the regulator does fine businesses that never named anyone at all, as it did the travel company above. This edition reads the statute, the regulator’s own decisions, the government’s own subsidy schedule and the register of certified firms, to work out what that gap is worth to somebody willing to be the named person for hire.
Start with the money. At 1 USD = 1.2801 SGD — the European Central Bank’s daily euro reference rates for 9 November 2026, 1.4328 SGD and 1.1193 USD to the euro, crossed — US$500 is S$640.05 and US$5,000 a month is S$6,400.50, or S$76,806 a year. The entry cost is not a fee schedule, because there is no fee. ACRA charges S$15 to apply for a business name and S$100 to register a sole proprietorship, and nothing else is payable to anyone to begin practising as an outsourced data protection officer in Singapore: no licence, no registration, no bond, no examination, no continuing fee. S$115 is 17.97% of the capital and the whole of the barrier.
Now the denominator, which is the part nobody states out loud. ACRA’s FY2025 annual report counts 625,437 live entities on the register at 31 March 2026 — 468,894 companies, 124,739 sole proprietorships, 16,627 limited liability partnerships, 12,889 partnerships, 1,338 variable capital companies — and 79,881 new entities formed in that year, up 11%. Section 11(3) reaches all of them, because the Act’s duty is on the “organisation” and not on a size, a sector or a turnover. Against that, IMDA’s own register of Data Protection Trustmark certified organisations, as of 9 January 2026, runs to forty pages and about 350 names — 0.056% of the register. The supply side of a universal statutory obligation has three hundred and fifty certified participants.
The reason the smallest buyer is the one who should pay is in the shape of the penalty, and it is the opposite of what people assume. The Commission’s enforcement guidelines put the maximum at “a financial penalty of up to S$1 million or 10% of the organisation’s annual turnover in Singapore”, with the 10% limb engaging only where turnover exceeds S$10 million. Below that line the maximum is a flat S$1 million regardless of how small you are. So the statutory maximum as a share of turnover is 200% for a firm turning over S$500,000, 100% at S$1 million, 20% at S$5 million and 10% at S$10 million and above. The cap is regressive, and the firms carrying the heaviest proportional exposure are precisely the ones with nobody in the building who has read the Act.
Set that against the price of removing it. The only published Singapore annual price located on this run is Privacy Ninja’s — “Annual subscription starts at only S$3,000” for an outsourced DPO, on a page last updated 29 September 2026. One million divided by three thousand is 333.33, and because the S$1 million cap is flat all the way up to S$10 million of turnover, that ratio is identical for every organisation below the threshold. A hawker’s holding company and a S$9 million engineering firm face the same maximum and the same published price. That constant is the whole sales argument, and it is drawn below.
The ladder itself is unusually short. At S$3,000 a year, 25.602 clients bill S$6,400.50 a month. Keeping US$5,000 after S$300 a year of per-client tooling, S$500 a month of overhead, compulsory Medisave and Singapore resident income tax takes 34.47 clients and S$103,396.71 of annual billings — a ratio of only 1.346, against the 2.392 a resold telephone seat needed last week, because a retainer has almost no cost of goods. Break-even is 2.22 clients. The base case of 25 clients nets US$3,576.50 a month, which is 71.5% of the target and the honest answer to what one person can reach in a year. Thirty-four clients is 0.0055% of the register.
The consensus read of Singapore privacy enforcement is that it is a large-company problem: Marina Bay Sands, 665,495 member records, S$315,000. The decisions say something narrower and more useful. The Commission fined Air Sino-Euro S$47,000 on facts that included an unfilled post costing nothing to fill, and the government is already paying people to fill it — IMDA’s Data Protection Essentials kit put a S$1,600 grant against a service it priced from S$2,500 for one-time setup, 64% of the floor price, with appointing a DPO listed inside the governance component. The state mandates the demand, prices the service, subsidises the purchase and licenses nobody on the supply side. That is not a loophole; it is a published market with a missing middle.
The evidence
11 findings“Designate one or more individuals” — and publish their contact details
Section 11(2) makes an organisation “responsible for personal data in its possession or under its control”. Section 11(3) requires it to “designate one or more individuals to be responsible for ensuring” compliance with the Act. Section 11(4) lets that individual “delegate to another individual the responsibility”. Section 11(5) requires the organisation to “make available to the public the business contact information” of at least one designated or delegated person; section 11(5A) deems that satisfied where a designated individual’s business contact information is published in a prescribed manner. Section 11(6) is the sting: designating somebody “does not relieve the organisation of any of its obligations”. Section 12 adds the policies, the complaints process, the communication to staff and the duty to make the information available on request. Nothing in either section imposes a qualification, a licence or a fee on the individual designated. Personal Data Protection Act 2012, SSO
Air Sino-Euro Associates Travel Pte. Ltd. — S$47,000, and no DPO until after the incident
The Commission found the organisation negligently breached the Accountability Obligation under ss 11(3) and 12, and the Protection Obligation under s 24. At [17]: “The appointment of a DPO is a basic requirement, and part of the Accountability Obligation.” At [18]: “the Commission determines that the Organisation has negligently breached the Accountability Obligation.” The organisation had no DPO until 15 April 2024, after the incident. The protection lapses read like a list of what an outsourced officer is hired to catch: no cybersecurity or data-protection clauses in the vendor contract, Windows Server 2012 still running after end of support, no multi-factor authentication and no password complexity requirement. Financial penalty S$47,000 payable within 30 days, at [51]; directions at [52] within 90 days to write the policies, fix the vendor contracts, engage a CSA-licensed provider for vulnerability assessment and penetration testing, implement MFA and send the Commission the documents. PDPC decision, DP-2312-C1857 (PDF)
Marina Bay Sands Pte. Ltd. — 665,495 members, S$315,000
A threat actor reached the records of about 665,495 Sands Rewards Lifestyle members between 19 and 20 October 2023, first by guessing the four-digit birthdate PINs of six accounts and then by exploiting a middleware migration that left one API outside the token verification policy, so member IDs could be changed in requests. The organisation admitted a breach of the Protection Obligation and the Commission found it negligent. At [37] the Commissioner “preliminarily determined that the Organisation should pay a financial penalty of $450,000”; at [119] and [122] that was reduced to $315,000, payable within 30 days, with interest thereafter at the Rules of Court 2021 judgment-debt rate. At [31] the Commission took the organisation’s annual turnover in Singapore into account; at [32] it recorded the 10% ceiling for organisations above the S$10 million threshold. This is the case everyone cites, and it is the wrong one to reason from. PDPC decision, Marina Bay Sands (PDF)
The maximum is S$1 million or 10%, and the 10% only bites above S$10 million
Paragraph 27.1: the Commission may require payment of “a financial penalty of up to S$1 million or 10% of the organisation’s annual turnover in Singapore”, whichever is higher, for any intentional or negligent contravention of the Data Protection Provisions; footnote 53 confines the 10% limb to organisations whose annual turnover in Singapore exceeds S$10 million. Paragraph 27.2 and footnote 56 set a different ceiling for Do Not Call contraventions: S$1 million or 5% where turnover exceeds S$20 million, and S$1 million for other DNC breaches. Paragraph 27.3: turnover is taken from “the most recent audited accounts of the organisation available at the time the financial penalty is imposed”. Paragraph 27.4.1 assesses harm and culpability; 27.4.2 weighs remedial action and prior non-compliance; paragraph 27.5, Table 1, lists the s 48J(6) factors against past decisions. Paragraphs 28.1 to 28.2: a written notice and preliminary decision first, then 14 days for written representations — which is how S$450,000 became S$315,000. PDPC, Advisory Guidelines on Enforcement (PDF)
The denominator: 625,437 live entities, 79,881 more last year
Live entities on ACRA’s register at 31 March 2026: 625,437, up 3%. Companies 468,894 (75.0%), sole proprietorships 124,739 (19.9%), limited liability partnerships 16,627 (2.7%), partnerships 12,889 (2.1%), variable capital companies 1,338 (0.2%), limited partnerships 950 (0.2%). New entities formed in FY2025: 79,881, up 11% — 58,667 companies, 18,224 sole proprietorships, 1,526 LLPs, 1,071 partnerships, 202 VCCs, 191 limited partnerships. Every one of these is an organisation for the purposes of s 11(3) from the day it starts handling personal data, and 79,881 of them arrive each year never having been told so. ACRA Annual Report FY2025 (PDF)
The supply side, counted: about 350 certified organisations
IMDA publishes the Data Protection Trustmark register as a dated PDF. The 9 January 2026 edition runs to 40 pages, carries no serial-number column, and ends with YCH Group Pte Ltd at 8 Bulim Avenue. Each row gives an initial certification date and a certification end date, and the periods vary — October 2025 to October 2028 appears alongside December 2019 to December 2025, so some entries on the list have already lapsed by its own date. The count is about 350 organisations, which against 625,437 live entities is 0.056%. The Trustmark is voluntary and is not the same thing as a DPO; it is the only published measure of how many Singapore organisations have had their data-protection practices assessed by anyone at all. IMDA, DPTM certified organisations, 9 January 2026 (PDF)
The state put S$1,600 against a service it priced from S$2,500
The DPE kit describes a one-stop professional service that “starts from $2,500 for one-time setup”, with the retainer price set by the provider and a minimum one-year retainer required. Against it the kit offers a fixed grant of S$1,600 — not a percentage — to first-time DPE users who complete the setup including the six-month review and sign the retainer, applied for before the service starts. Eligibility: registered and operating in Singapore, at least 30% local shareholding, group annual sales turnover not more than S$100 million or group employment not more than 200; non-profits and SMEs already on CSA’s CISOaaS are excluded. The setup components are the governance item — which is appointing a DPO — plus a data protection and security policy, an asset inventory map, anti-virus, system security, encryption, backup, a breach and incident response plan and staff training; the six-month review adds updates, a phishing simulation and a desktop exercise. This kit’s own application window closed on 31 March 2024, with claims due 30 November 2024; the current grant quantum was not established on this run. IMDA, DPE information kit, 22 March 2024 (PDF)
DPO registration left the company register on 1 December 2024
ACRA announced that from 1 December 2024 DPO registration on BizFile+ is unavailable “until further notice”, with no end date given, and that organisations registering a new DPO or updating existing DPO information must instead use an online form on the PDPC website at pdpc.gov.sg/dpo. The audience named is accounting entities, businesses and corporate service providers. The practical consequence is that the one moment at which every new Singapore company used to be asked, inside the incorporation flow, who its data protection officer was, no longer happens there. PDPC’s own page now offers “Submit or update your DPO’s details and have them published in the DPO Registry” and a separate search to check whether a listed DPO is still current. ACRA, Updated Process in Data Protection Officer (DPO) Registration · PDPC, DPO Registry
The retail price, published once: from S$3,000 a year
Privacy Ninja’s outsourced DPO page states “Annual subscription starts at only S$3,000” and lists what it includes: the DPO filing with the PDPC, ongoing DPO support with a named client success manager, bi-annual audits and risk assessments, a data protection management programme, a privacy policy review, a weekly PDPA newsletter, PDPC e-learning for employees, leaked-password checks, phishing and spoofing tests, and S$1 million of professional indemnity insurance. Hawksford Singapore publishes a comparable outsourced DPO package — official contact point, gap analysis, policies and SOPs, breach response plan, user-rights handling, staff training, annual re-assessment and a board resolution appointing and registering the DPO — and no price at all; the page is a contact form. One published annual price is the entire retail side of this edition and it is thin: a single “starts at” figure from a single vendor. Privacy Ninja, outsourced DPO · Hawksford, data protection services
The two schedules the net figure runs through: S$115 in, resident bands out
ACRA: S$15 to apply for a business entity name, S$100 to register a sole proprietorship or partnership, S$30 to renew. IRAS, from YA2024: “The top marginal Personal Income Tax (PIT) rates will be increased with effect from Year of Assessment (YA) 2024”, on a resident table reading first 20,000 at 0, next 10,000 at 2% (cumulative 200), next 10,000 at 3.5% (550), next 40,000 at 7% (3,350), next 40,000 at 11.5% (7,950), next 40,000 at 15% (13,950), next 40,000 at 18% (21,150), next 40,000 at 19% (28,750), rising to 24% above S$1,000,000. Income earned in calendar 2026 is assessed in YA2027. ACRA fees · IRAS, Budget 2022 overview (PDF)
25.602 clients bill the target and 34.47 keep it
Rate: 1 USD = 1.2801 SGD, from the European Central Bank’s daily euro reference rates for 9 November 2026 — 1.4328 SGD and 1.1193 USD to the euro — crossed: 1.4328 ÷ 1.1193 = 1.28008. Capital US$500 = S$640.05. Target US$5,000/month = S$6,400.50/month = S$76,806/year.
Entry: 15 + 100 = S$115, which is 115 ÷ 640.05 = 17.97% of capital, or US$89.84.
The cap as a share of turnover: 1,000,000 ÷ 500,000 = 200%; ÷ 1,000,000 = 100%; ÷ 5,000,000 = 20%; ÷ 10,000,000 = 10%, where the 10% limb takes over and the line goes flat. Exposure against price: 1,000,000 ÷ 3,000 = 333.33×, constant for every turnover below S$10,000,000 because both terms are flat sums.
Trustmark: 350 ÷ 625,437 = 0.056%. Subsidy: 1,600 ÷ 2,500 = 64.0% of the published setup floor, leaving S$900 to the buyer.
Billing: 6,400.50 ÷ (3,000 ÷ 12) = 25.602 clients. Break-even: 6,000 ÷ 2,700 = 2.22 clients.
Keeping: net trade income = clients × (3,000 − 300) − 6,000; Medisave 8% of NTI capped at S$7,680; chargeable = NTI − 1,000 earned income relief − Medisave; tax on the resident bands IRAS states from YA2024. Solving net ÷ 12 ÷ 1.2801 = US$5,000 gives 34.47 clients, billings S$103,396.71, NTI S$87,057.04, Medisave S$6,964.56, tax S$3,286.47, net S$76,806.00 — a ratio of 1.346× the clients that bill it. 34.47 ÷ 625,437 = 0.0055% of the register.
Cases: base 25 clients, S$3,000, S$300 tooling, S$500/month overhead → S$75,000 billed, NTI S$61,500, Medisave S$4,920, tax S$1,640.60, net US$3,576.50/month, which is 71.5% of the target. Best 60 clients at S$4,500 with S$400 tooling and S$900/month overhead → NTI S$235,200, Medisave at its S$7,680 ceiling, tax S$26,188.80, net US$13,106.48/month. Downside 6 clients → NTI S$10,200, Medisave at the 4% band S$408, no tax, net US$637.45/month.
Plotted in the figure: y = max(1,000,000, 0.10x) ÷ x against x from 500,000 to 20,000,000, and y = 3,000 ÷ x over the same range, both on log axes. x: 564 px ÷ 1.60206 decades = 352.0 px per decade from x = 96 at S$500,000. y: 260 px ÷ 5 decades = 52 px per decade from y = 320 at 0.01%. The 333.33× measure is log₁₀(333.33) × 52 = 131.2 px, drawn at S$2,000,000.
Assumptions, flagged: the S$300 a year of per-client tooling and the S$500 a month of overhead are not read from anywhere and are the two numbers most likely to be wrong; S$3,000 is one vendor’s published starting price, not a market rate; professional indemnity insurance is modelled inside the overhead at no stated premium; the operator is assumed a Singapore tax resident under 35 with no other income and no relief beyond earned income relief; and no figure here is a forecast of winning any client at all. ECB daily euro reference rates
The ladder
From $500 to $5,000 a month · S$640 → S$6,401ACRA charges S$15 for the business name and S$100 to register a sole proprietorship. After that nothing is payable to anybody to practise as an outsourced data protection officer in Singapore. There is no licence to buy, no register to join, no examination to sit and no renewal. Resist every suggestion that there is.
-
Spend S$115, then stop spending
ACRA charges S$15 for the business name and S$100 to register a sole proprietorship. After that nothing is payable to anybody to practise as an outsourced data protection officer in Singapore. There is no licence to buy, no register to join, no examination to sit and no renewal. Resist every suggestion that there is.
15 + 100 = S$115 of the S$640.05 -
Read the three documents that are the entire job
The Act itself, for ss 11, 12, 24 and 26. The Advisory Guidelines on Enforcement, for paragraphs 27 and 28 — the ceiling, the turnover basis, the harm-and-culpability test and the fourteen days of representations. Then the published decisions, which are where the Commission says what it actually expects. All three are free, and reading them is the only qualification this work has.
S$0 · the whole syllabus is published -
Sell the obligation, not the software
The buyer is not shopping. The buyer is an SME owner who has never heard of s 11(3) and whose maximum exposure is S$1,000,000 flat because turnover is under S$10 million. The pitch is two sentences of statute, one decision with a name and a number on it, and the ratio: the published price of removing the exposure is 1/333rd of the exposure, identically, at every turnover below the threshold.
1,000,000 ÷ 3,000 = 333.33× -
Quote the only published price, then move off it
S$3,000 a year is where one Singapore vendor opens, and it is the only annual figure published anywhere located on this run. Use it to anchor the first ten quotes, then stop: a one-vendor “starts at” price is a floor somebody else set. Every extra S$500 on the annual retainer is worth more than any amount of effort on the thing you are not allowed to charge for, which is the registration, because it is free.
6,400.50 ÷ 250 = 25.602 clients to bill it -
Take the government’s money with both hands, after checking it is still there
IMDA’s Data Protection Essentials kit put a fixed S$1,600 grant against a service it priced from S$2,500 for one-time setup — 64% of the floor, leaving S$900 to the buyer — with appointing a DPO sitting inside the governance component and a minimum one-year retainer attached. That kit’s own window closed on 31 March 2024 and the current quantum was not established here. Confirm it before you put it in a quote, because a subsidy you cannot deliver is worse than none.
1,600 ÷ 2,500 = 64.0% · window closed 2024-03-31 -
Count the two different client numbers before you celebrate the first one
Twenty-five point six clients bill S$6,400.50 a month. Thirty-four point four seven clients keep US$5,000 after S$300 a year of tooling each, S$500 a month of overhead, Medisave and income tax. The gap is only 1.346× — a retainer has almost no cost of goods, which is the whole reason this ladder is shorter than last week’s. Break-even is 2.22 clients, which arrives in the first quarter or not at all.
34.47 ÷ 25.602 = 1.346× · break-even 2.22 -
Know what you have become, because the Act does
Hold a client’s personal data to do this work and you are processing it on their behalf: a data intermediary, carrying the Protection and Retention Obligations in your own right. Section 11(6) says designating you “does not relieve the organisation of any of its obligations”, so the client keeps theirs and you acquire yours. One published competitor carries S$1 million of professional indemnity cover. Price yours before the first engagement letter, not after the first breach.
ss 24 and 26 apply to you, not only to them
Sources
14 primary documents- Personal Data Protection Act 2012, Singapore Statutes Online (ss 11, 12) — read 10 November 2026
- PDPC, Air Sino-Euro Associates Travel Pte. Ltd., DP-2312-C1857, [2025] SGPDPC 5, 31 October 2025 — read 10 November 2026
- PDPC, Marina Bay Sands Pte. Ltd., DP-2310-C1622, [2025] SGPDPC 6, 28 October 2025 — read 10 November 2026
- PDPC, Advisory Guidelines on Enforcement of the Data Protection Provisions (rev. 1 October 2022) — read 10 November 2026
- ACRA, Annual Report FY2025 (registry statistics at 31 March 2026) — read 10 November 2026
- IMDA, List of Data Protection Trustmark Certified Organisations (as of 9 Jan 2026) — read 10 November 2026
- IMDA, Data Protection Essentials information kit (updated 22 March 2024) — read 10 November 2026
- ACRA, Updated Process in Data Protection Officer (DPO) Registration (20 November 2024) — read 10 November 2026
- PDPC, DPO Registry — read 10 November 2026
- ACRA, Service & transaction fees: Sole proprietorships & partnerships — page updated 6 February 2026; read 10 November 2026
- IRAS, Budget 2022 — Overview of Tax Changes (YA2024 resident bands) — read 10 November 2026
- Privacy Ninja, Outsourced Data Protection Officer (DPO) Service — page updated 29 September 2026; read 10 November 2026
- Hawksford Singapore, Outsourced data protection services — read 10 November 2026
- European Central Bank, daily euro foreign exchange reference rates — Cube time 2026-11-09; 1 USD = 1.2801 SGD crossed through the euro
More like this
Same series or same scarce input- Singapore · Ed. 0063 Nov 2026 Singapore’s telecom licence is free and the interconnection deposit behind it is S$20,000. Existing clients or audience
- Singapore · Ed. 00527 Oct 2026 Singapore’s tuition cap is nine pupils in total, not nine per class. Existing clients or audience
- Singapore · Ed. 00313 Oct 2026 Above six permits a month, hiring a Singapore customs agent loses money. Existing clients or audience
Browse the catalog — every edition, by verdict, scarce input and window